Hello,
Here is my search output. I want see , if Count of "Down" > "Up" criteria. Than I can understand, interface is stil down!
index=syslog field7="nw_ra_m016_02.34bhsr" "%%01ISIS" AdjState="1" OR AdjState="3" OR AdjState="Down" OR AdjState="Up" |stats count by field7,IfName,AdjState
Field7 which is host
IfName : Interface name
AdjState : Protocol state which is IS-IS
Print? I assume you want this piece of information somewhere on the dashboard - decide where and what you want to show then craft the search accordingly, based on the examples shown. Those examples should give you enough to either create a new panel or add to the existing.
If you want a new search to calculate this, then
index=syslog field7="nw_ra_m016_02.34bhsr" "%%01ISIS" AdjState="1" OR AdjState="3" OR AdjState="Down" OR AdjState="Up"
| stats sum(eval(if(AdjState="Down",1,0))) as Down sum(eval(if(AdjState="Up",1,0))) as Up by field7 IfName
| eval CurrentState="Interface ".if(Up>Down, "Up", "Down")
and that will give you 'Interface Up' or 'Interface Down'. However, is this a reliable indicator? If the values are the same, then you need to know the starting state of the interface at the start of your search interval, as equal counts will indicate that the interface is in the same state that it was at the start of your search interval.
If you want to add a new column to the existing table you have then do this
| eventstats max(eval(if(AdjState="Down",count,0))) as Down max(eval(if(AdjState="Up",count,0))) as Up by field7 IfName
| eval CurrentState="Interface ".if(Up>Down, "Up", "Down")
| fields - Up Down
Hope this helps
Thank you for interesting.
Actually, if count of down > up, i want print like warning message.
Print? I assume you want this piece of information somewhere on the dashboard - decide where and what you want to show then craft the search accordingly, based on the examples shown. Those examples should give you enough to either create a new panel or add to the existing.